Azure Automation Subscription Null or Empty

What do you do if you are setting up a new Runbook in Azure Automation and get a message similar to:

“Cannot validate argument on parameter ‘Subscription.’ The argument is null or empty.”

No Subscription Error
No Subscription Error

And this is a new managed identity, or maybe the first time using the identity?

Looking at the roles assigned to a new System Assigned Managed Identity, we can see that all the RBAC roles are from Azure AD.  Remember, the subscription and Azure AD are different scopes for RBAC roles.  By default, a new System or User Managed Identity does not have rights to the subscription. 

Default Azure AD Roles

The default settings have no Subscription level rights.  Because of that, no subscription value returns when the Connect-AzAccount -Identity command runs to authenticate the runbook with the managed identity.  We can verify that with the output from the $AzureContext variable used to authenticate the runbook.

No Subscription

The fix is easy, assign the managed identity a role in the subscription.  Odds are, you intend to do that anyway.  After all, why log in with the managed identity if it’s not going to interact with the subscription?

Once we assign a role in the subscription, the login context will have a subscription to add.

With Subscription

2 thoughts on “Azure Automation Subscription Null or Empty

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.